Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    15-08-2023 15:09

General

  • Target

    04eda95779ded417ce8c151a83ce783f2369df3e660caf7ba3a09fb0310352f4_JC.exe

  • Size

    343KB

  • MD5

    c4ddd8bb189f2874fd7a9369ece35c92

  • SHA1

    e53e275bbe5b1347b81e98f55d5f5e4928e005a8

  • SHA256

    04eda95779ded417ce8c151a83ce783f2369df3e660caf7ba3a09fb0310352f4

  • SHA512

    05ecde33d466ed86c562f3a6ef0db774ef8881f91ef494a24eef4f6b6e96a90c650c2d8c32711ee9528a858350461f0adf3e823577a214e83b410024cffee856

  • SSDEEP

    6144:OGk39+NYmFGGF2Cx9hZs8KBUsq4eetIVz7m4:nQyYmFfv9/BKBdrdKVW4

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\04eda95779ded417ce8c151a83ce783f2369df3e660caf7ba3a09fb0310352f4_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\04eda95779ded417ce8c151a83ce783f2369df3e660caf7ba3a09fb0310352f4_JC.exe"
    1⤵
      PID:1148

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1148-55-0x0000000002470000-0x0000000002570000-memory.dmp

      Filesize

      1024KB

    • memory/1148-56-0x0000000003F30000-0x0000000003F68000-memory.dmp

      Filesize

      224KB

    • memory/1148-57-0x0000000000400000-0x00000000022FD000-memory.dmp

      Filesize

      31.0MB

    • memory/1148-58-0x00000000067F0000-0x0000000006830000-memory.dmp

      Filesize

      256KB

    • memory/1148-59-0x00000000067F0000-0x0000000006830000-memory.dmp

      Filesize

      256KB

    • memory/1148-60-0x0000000000250000-0x000000000028F000-memory.dmp

      Filesize

      252KB

    • memory/1148-62-0x0000000074500000-0x0000000074BEE000-memory.dmp

      Filesize

      6.9MB

    • memory/1148-61-0x0000000003D90000-0x0000000003DC4000-memory.dmp

      Filesize

      208KB

    • memory/1148-64-0x0000000002460000-0x0000000002466000-memory.dmp

      Filesize

      24KB

    • memory/1148-63-0x00000000067F0000-0x0000000006830000-memory.dmp

      Filesize

      256KB

    • memory/1148-65-0x00000000067F0000-0x0000000006830000-memory.dmp

      Filesize

      256KB

    • memory/1148-66-0x0000000002470000-0x0000000002570000-memory.dmp

      Filesize

      1024KB

    • memory/1148-67-0x0000000000400000-0x00000000022FD000-memory.dmp

      Filesize

      31.0MB

    • memory/1148-69-0x00000000067F0000-0x0000000006830000-memory.dmp

      Filesize

      256KB

    • memory/1148-70-0x0000000074500000-0x0000000074BEE000-memory.dmp

      Filesize

      6.9MB

    • memory/1148-71-0x00000000067F0000-0x0000000006830000-memory.dmp

      Filesize

      256KB